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DETAILED ACTION 

i> This action is in response to Applicant's request for continued examination. Claims 

26-29 are added. Claims 3, 4, 8, 14, 15, and 19 are amended. Claims 3-9, 11, 14-20, and 22-29 are 
presented for further examination. 

2> This is a non-final rejection. 

Continued Examination Under 37 CFR 1.114 

3> A request for continued examination under 37 CFR 1.114, including the fee set forth in 
37 CFR 1.17(e), was filed in this application after final rejection. Since this application is 
eligible for continued examination under 37 CFR 1.114, and the fee set forth in 37 CFR 1.17(e) 
has been timely paid, the finality of the previous Office action has been withdrawn pursuant 
to 37 CFR 1. 114. Applicant's submission filed on 10.31.2007 has been entered. 

Response to Arguments 

4> As to the §112, first pararaph rejection of claims 1 and 14, Applicant's arguments are 
persuasive and the rejection is withdrawn. As to the §112, first paragraph rejection of claims 4 
and 15, Applicant's amendment overcomes the rejection which is therefore withdrawn. 

5> Applicant has amended the independent claims to now recite that the packet monitor 
"is configured to monitor at least one of a data sequence of said packets, a service identifier of 



Art Unit: 2152 

said packets, and a checksum of said packets." Applicant argues that none of the cited prior 
art references disclose this feature. 

According to Applicant's specification, a "service identifier means control data used 
for identifying a service which the AP server 8 provides to a user, such as e-mail service." 
(Pg. 8, 11. 8-10). Thus, Applicant's new limitation recites a packet monitor device that is 
configured to monitor packets based on at least control data that identifies a particular 
service that is provided to a user. Similarly, Abraham discloses monitoring packets based on 
control data the identifies a particular service that is provided to a user, such as email, the 
web or FTP [Figure 8J | column 21 «lines 39'5o» : protocol ID]. Thus, Abraham discloses the 
new limitation as claimed. 

Claim Rejections - 35 USC § 103 
The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art 

person having ordinary skill in the art to which said subject matter pertains. Patentability shall not be 
negatived by the manner in which the invention was made. 

6> Claims 3, 6-9, 11, 14, 17-20 and 22-25 are rejected under 35 U.S.C 1103(a) as being 
unpatentable over Abraham et al, U.S Patent No. 5.983.270 ["Abraham"], in view of Nickles, 
U.S Patent No. 6. 134.591. 
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7> As to claim 1, Abraham discloses a system for monitoring packets transmitted on a 
channel connecting an application server and an end-user of said application server to each 
other, said system comprising: 

a certification server which certificates the end-user [column 5 «line 6^» to column 6 
«line 4»]; and 

a packet monitor device which, on receipt of a request from said certification server, 
monitors packets transmitted on said channel [column 1 «lines I3'i7» | column 7 «lines 51- 
6 7 »], 

wherein said certification server includes: 

a first memory which stores a user management table including ID numbers of 
end-users, a monitoring parameter designating a packet to be monitored, a threshold 
parameter designating a method of monitoring said packet [Figures 9D, 17, 25A, 25B : 
notify rule, log rule | column 15 «lines 35'40»]; and 

a second device which transmits a request to said packet monitor device to 
start or finish monitoring said packet at a timing when said end-user logs-in or logs- 
out the terminal [column 9 «lines i-io»]; 
wherein said packet monitor device includes: 

a fourth memory which stores a first time at which a packet transmitted from one of 
said application server and said user arrives, when said packet monitor device receives a 
request from said second device to monitor said packet [Figure 20 | column 47 «lines i4'24» | 
see also response to arguments above]; 
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an analyzer which monitors a second time at which packets meeting said monitoring 
parameter arrive, and determines whether any rule has been satisfied during an interval 
between said first time and said second time [column 7 «lines ^i-6j» | column 9 «lines 5i-65» 
I column 47 «lines i4-24» | column 41 «line 53» to column 42 «line 42»]; and 

an annunciator which makes annunciation to said user when a certain rule is satisfied 
during said interval [Figure 26 | column 11 «lines 53-64» | column 13 «lines 62-67]; and 

wherein said packet monitor device is configured to monitor at least one of a data 
sequence of said packets, a service identifier of said packets [Figure 8J | column 21 «lines 39- 
5o» : protocol ID identifies the type of service - for example, email, web, or FTP], and a 
checksum of said packet. 

Abraham does not expressly disclose storing a password in the table. However such a 
feature was well known in the art at the time of Applicant's invention. Abraham does 
disclose storing user's information, including the user's ID and access level [column 16 «lines 
6-9»]. Additionally, as is well known in the art, Abraham also discloses the feature whereby 
a user logs on to his terminal using a password [column 5 «lines 6y6j» \ see also response to 
arguments above]. In a related field of invention, Nickles discloses a management database 
that stores usernames with their respective passwords for the same purpose as Abraham 
[Figure 7 «item 7o8a» | column 6 «lines 7"i7»]. Therefore it would have been obvious to one 
of ordinary skill in the art to have reasonably inferred that Abraham's management table 
would contain passwords. Such a feature is implied by Abraham because he teaches that a 
user is monitored only after logging into the LAN. One of ordinary skill in the art would 
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understand this to include submitting a user ID and a password as is well known in the art. 
Thus, passwords are stored with user IDs, as further evinced by Nickles. 

8> As to claim 3, Abraham discloses: 

a fourth memory which stores a first time at which a packet transmitted from one of 
said application server and said user arrives, when said packet monitor device receives a 
request from said second device to monitor said packet [Figure 20 | column 47 «lines i4-24»]; 

an analyzer which monitors a second time at which packets meeting said monitoring 
parameter arrive, and determines whether any rule has been satisfied in an interval in said 
second time [column 7 «lines 5i-67» | column 9 «lines 5i-65» | column 47 «lines I4'24»]; and 

an annunciator which makes annunciation to said user when there is a certain rule in 
said interval [Figure 26 | column 11 «lines 53-64» | column 13 «lines 62"67»]. 

9> As to claim 6, Abraham discloses the packet monitor device including: 

a second memory which stores said monitoring parameter transmitted from said 

second device [column 7 «lines 22"5o»]; 

a third memory which stores said threshold parameter transmitted from said second 

device [column 2 «lines 47'53» | column 7 «lines 22"50»]; and 

a third device which said third and fourth memories when said second device 

transmits a request to said packet monitor device to start or finish monitoring said packet 

[column 6 «line 6o» to column 7 «line 3» | column 7 «lines 22"50» | column 47 «lines 5'24»]. 
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io> As to claim 7, Abraham discloses the analyzer analyzing whether there is any rule in 
said interval and whether said interval exceeds said threshold parameter [column 11 «lines 53- 
64»], and said annunciator makes annunciation to said end-user when said analyzer judges 
that there is a certain rule in said interval and that said interval exceeds said threshold 
parameter [column 13 «lines 53-6o»]. 

n> As to claim 8, Abraham discloses a method of monitoring packets transmitted on a 
channel connecting an application server and an end-user of said application server to each 
other, comprising the steps of: 

acquiring a monitoring parameter indicative of a packet to be monitored, when said 
end-user logs-in his|her terminal [column 5 «line 6^» to column 6 «line 4»]; 

monitoring a time at which packets coincident with said monitoring parameter arrive, 
and determining whether there is any rule in an interval between a time when the 
monitoring parameter is acquired said arrival time [column 7 «lines ^i-6j» | column 11 «lines 
53-64» I column 41 «line 53» to column 42 «line 42»]; 

making annunciation to said end-user when there is a certain rule in said interval 
[column 13 «lines 6i-6j»~\; and 

monitoring at least one of a data sequence of said packets, a service identifier of said 
packets [Figure 8J | column 21 «lines 39'5o» : protocol ID identifies the type of service - for 
example, email, web, or FTP], and a checksum of said packet; 

wherein said monitoring parameter is included in a user management table which 
further includes an ID number of said user and a threshold parameter designating a method 
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of monitoring said packet [Figures 9D, 17, 25A, 25B : notify rule, log rule | column 15 «lines 35- 
4o»], and said step includes the steps of: 

retrieving said user management table, based on said ID number input by said end- 
user [column 8 «lines i3'25» | column 16 «lines iz~ig» : user must log in to the LAN before 
monitoring begins - process of logging in submits his user ID]; 

acquiring said monitoring parameter, if said monitoring parameter is stored in said 
user management table [Figure 17 : user rules]; and 

acquiring said threshold parameter, if said threshold parameter is stored in said user 
management table [Figures 17, 25B : user policies such as quota limit | column 34 «lines 11- 
5 8»]. 

Abraham does not disclose storing a password related to the users. However such a 
feature was well known in the art at the time of Applicant's invention. Abraham does 
disclose storing user's information, including the user's ID and access level [column 16 «lines 
6-9»]. Additionally, as is well known in the art, Abraham also discloses the feature whereby 
a user logs on to his terminal using a password [column 5 «lines 63-67»]. In a related field of 
invention, Nickles discloses a management database that stores usernames with their 
respective passwords for the same purpose as Abraham [Figure 7 «item 7o8a» | column 6 
«lines 7"i7»]. Therefore it would have been obvious to one of ordinary skill in the art to have 
reasonably inferred that Abraham's management table would contain passwords. Such a 
feature is implied by Abraham because he teaches that a user is monitored only after logging 
into the LAN. One of ordinary skill in the art would understand this to include submitting a 
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user ID and a password as is well known in the art. Thus, passwords are stored with user 
IDs, as further evinced by Nickles. 

I2> As to claim 9, Abraham discloses ceasing monitoring when said end-user logs-out 
his|her terminal [column 8 «lines 23'25»]. 

I3> As to claim 11, Abraham discloses the step including the step of analyzing whether 
there is a certain rule in said interval and whether said interval exceeds said threshold 
parameter, after acquiring said threshold parameter and said step includes the step of making 
annunciation to said end-user, if there is a certain rule in said interval and said interval 
exceeds said threshold parameter [column 11 «lines 53-64» | column 13 «lines 53-6o»]. 

I4> As to claims 14, 17, and 18, as they are merely mediums that store the system of claims 
3, 6, and 7, respectively, they do not teach over the claimed limitations. Therefore claims 14, 
17, and 18 are rejected for the same reasons set forth for claims 3, 6, and 7, supra. 

I5> As to claims 19 and 20, as they are merely mediums that store the system of claims 8 
and 9, respectively, they do not teach over the claimed limitations. Therefore claims 19 and 20 
are rejected for the same reasons set forth for claims 8 and 9, supra. 
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i6> As to claims 21 and 22, as they are merely mediums that store the system of claims 10 
and 11, respectively, they do not teach over the claimed limitations. Therefore claims 21 and 22 
are rejected for the same reasons set forth for claims 10 and 11, supra. 

I7> As to claims 23 and 24, Abraham discloses the end-user is not performing an 
administrative function of said application server [column 5 «line 6^» to column 6 «line 4» : 
difference between client computers and administrative computers | column 16 «lines I2"i6»]. 

i8> As to claim 25, Abraham discloses the packet monitor is located in the channel 
between the application server and the end-user [Figure 2 «item 5o»]. 

ig> As to claim 26, Abraham discloses said packet monitor device is configured to 
compare information about said packets to said monitoring parameter [column 45 «lines i-3i» 
: determining whether the intercepted packets match any of the user-defined rules. Matching 
packets imply that the information about said packets is compared to the rules]. 

20> As to claim 27, Abraham discloses a counter, wherein said counter is configured such 
that, if said rule is satisfied, then said counter is incremented [column 14 «lines 32'40» | 
column 46 «lines n-24» | column 48 «lines 4i-54» where : Abraham's log reads on Applicant's 
claimed counter. Every time a rule matches a rule, the log is updated to indicate the match. In 
this way, the log provides a count of the packets that matched the monitoring rule]. 
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2i> As to claim 28, Abraham discloses a comparator, which compares said counter to said 
threshold parameter [column 49 «lines i-22» where : the count in the log table is compared 
with a quota threshold]. 

22> As to claim 29, Abraham discloses said threshold parameter comprises a duration after 
which a packet coincides with the monitoring parameter [column 40 «lines 20-34» : 
predetermined time interval] or a service fee. 

23> Claims 4, 5, 15 and 16 are rejected under 35 U.S.C 1103(a) as being unpatentable over 
Abraham in view of Engel et al, U.S Patent No. 6. 115.393. 

24> As to claim 4, Abraham discloses a system for monitoring packets transmitted on a 
channel connecting an application server and an end-user of said application server to each 
other, said system comprising: 

a certification server which certificates the end-user [column 5 «line 6^» to column 6 
«line 4»]; and 

a packet monitor device which, on receipt of a request from said certification server, 
monitors packets transmitted on said channel [column 1 «lines I3'i7» | column 7 «lines 51- 
6 7 »], 

wherein said certification server includes: 

a first memory which stores a user management table including ID numbers of 
end-users, a monitoring parameter designating a packet to be monitored, a threshold 
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parameter designating a method of monitoring said packet [Figures 9D, 17, 25A, 25B : 
notify rule, log rule | column 15 «lines 35'4o»]; 

a second device which transmits a request to said packet monitor device to start or 
finish monitoring said packet at a timing when said end-user logs-in or logs-out the terminal 
[column 9 «lines i-io»]; and 

wherein said packet monitor device monitors an interval between which packets 
arrive at said end-user from said application server and vice versa [column 9 «lines 56-65»], 
and said certification server makes annunciation to said end-user [column 13 «lines 6i-6j»], 
and 

wherein said packet monitor device is configured to monitor at least one of a data 
sequence of said packets, a service identifier of said packets [Figure 8J | column 21 «lines 39- 
5o» : protocol ID identifies the type of service - for example, email, web, or FTP], and a 
checksum of said packet. 

Abraham does not disclose that the monitoring and threshold parameters are updated 
by instruction of the end-user. However, such a feature was well known in the art at the time 
of Applicant's invention. For example, Engel discloses a network monitoring system. Engel 
discloses that monitoring and threshold parameters that dictate what packets are to be 
monitored are controlled by an end-user [column 30 «line 55» to column 31 «line I3»]. It 
would have been obvious to one of ordinary skill in the art to modify Abraham to include 
Engel's functionality. One would have been motivated to provide such functionality to 
enable all network users to modify parameters associated with the monitors of a network; 
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this capability is "normally the prerogative of the system administrator" and thus Engel's 
teachings would benefit Abraham's network monitoring system. 

25> As to claim 5, Abraham discloses the packet monitor device including: 

a second memory which stores said monitoring parameter transmitted from said 

second device [column 7 «lines 22"5o»]; 

a third memory which stores said threshold parameter transmitted from said second 

device [column 2 «lines 47'53» | column 7 «lines 22"50»]; and 

a third device which said third and fourth memories when said second device 

transmits a request to said packet monitor device to start or finish monitoring said packet 

[column 6 «line 6o» to column 7 «line 3» | column 7 «lines 22"50» | column 47 «lines 5'24»]. 

26> As to claims 15 and 16, as they do not teach or further define over previously claimed 
limitations, they are rejected for at least the same reasons set forth for claims 4 and 5, 
respectively. 

Conclusion 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to DOHM CHANKONG whose telephone number is (571)272- 
3942. The examiner can normally be reached on Monday-Friday [8:30 AM to 4:30 PM]. 
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If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Bunjob Jaroenchonwanit can be reached on 571.272.3913. The fax phone number 
for the organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published 
applications may be obtained from either Private PAIR or Public PAIR. Status information 
for unpublished applications is available through Private PAIR only. For more information 
about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on 
access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217- 
9197 (toll-free). If you would like assistance from a USPTO Customer Service 
Representative or access to the automated information system, call 800-786-9199 (IN USA 
OR CANADA) or 571-272-1000. 



/Dohm Chankong/ 

Examiner, Art Unit 2152 

Temporary Partial Signatory Authority 
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